CVE Vulnerability Advisory Database

[Affected Scope] Systems utilizing the SAP NetWeaver Visual Composer Metadata Uploader module

[Impact] A privileged attacker can upload untrusted or malicious content, triggering deserialization of untrusted data (CWE-502) and potentially compromising the confidentiality, integrity, and availability of the host system

[Mitigation] Immediately apply the official security patch (SAP Note 3604119) and restrict access to unauthorized metadata upload endpoints

[Affected Scope] SAP systems utilizing the SAP NetWeaver Visual Composer Metadata Uploader component.

[Impact] Unauthenticated remote attackers can upload malicious executable binaries (such as web shells), leading to complete compromise of system confidentiality, integrity, and availability.

[Mitigation] Immediately apply the official security patch (SAP Note 3594142) and restrict external access to the Metadata Uploader endpoints.

[Affected Scope] SAP NetWeaver AS ABAP, AS Java, ABAP Platform, SAP Content Server 7.53, and SAP Web Dispatcher

[Impact] Unauthenticated attackers can prepend arbitrary data to a victim's request, enabling session hijacking, cache poisoning, and complete compromise of system Confidentiality, Integrity, and Availability

[Mitigation] Immediately apply the official SAP security patches (SAP Note 3123396) and restrict anomalous HTTP request headers at the reverse proxy or WAF level

[Affected Scope] SAP NetWeaver (Visual Composer 7.0 RT) versions 7.30, 7.31, 7.40, and 7.50

[Impact] An authenticated non-administrative attacker can upload malicious files and execute arbitrary OS commands with the privileges of the Java Server process, leading to full system compromise or denial of service

[Mitigation] Immediately apply the official patch specified in SAP Security Note 3084487 and restrict access to vulnerable upload endpoints

[Affected Scope] SAP NetWeaver AS JAVA (LM Configuration Wizard) versions 7.30, 7.31, 7.40, and 7.50

[Impact] Unauthenticated remote attackers can execute configuration tasks, create administrative accounts, and fully compromise system confidentiality, integrity, and availability

[Mitigation] Apply SAP Security Note 2934135 immediately or disable/restrict access to the CTC Web Service

[Affected Scope] All SMDAgents connected to SAP Solution Manager (User Experience Monitoring) version 7.2

[Impact] Unauthenticated attackers can compromise all connected SMDAgents and execute arbitrary remote commands with high privileges

[Mitigation] Immediately apply the official SAP security patch (SAP Note 2890213) and restrict network access to the Solution Manager ports

[Affected Scope] SAP Commerce Cloud (formerly Hybris) versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, and 1905 with the virtualjdbc extension enabled

[Impact] Unauthenticated remote attackers can exploit insecure deserialization to execute arbitrary system commands with 'Hybris' user privileges on the target host

[Mitigation] Apply the official SAP security patch (SAP Note 2786035), disable the unused virtualjdbc extension, or restrict external access to the endpoint

[Affected Scope] SAP CRM versions 7.01, 7.02, 7.30, 7.31, 7.33, and 7.54

[Impact] Attackers can bypass path validation using directory traversal sequences to upload malicious JSP files, leading to arbitrary Remote Code Execution (RCE)

[Mitigation] Apply SAP Security Note 2547431 immediately and implement WAF rules to block directory traversal patterns (../)

[Affected Scope] SAP NetWeaver Application Server Java version 7.5.

[Impact] Unauthenticated remote attackers can read arbitrary system and configuration files by exploiting a directory traversal vulnerability using '..' sequences in the query string.

[Mitigation] Apply SAP Security Note 2486657 immediately, and implement WAF rules to block directory traversal patterns in the interim.

[Affected Scope] BC-BMT-BPM-DSK component in SAP NetWeaver AS JAVA 7.5.

[Impact] Remote authenticated attackers can conduct XML External Entity (XXE) attacks, leading to sensitive local file disclosure, SSRF, or DoS.

[Mitigation] Apply SAP Security Note 2296909 or restrict access to the vulnerable URI endpoint.

[Affected Scope] SAP NetWeaver Application Server Java platforms, typically prior to version 7.3

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands and Java code via crafted HTTP/HTTPS requests (CVSS 10.0)

[Mitigation] Apply SAP Note 1445998 and disable the Invoker Servlet globally in the web.xml configuration

[Affected Scope] SAP NetWeaver Application Server Java versions 7.1 through 7.5

[Impact] Unauthenticated remote attackers can read arbitrary system and configuration files by exploiting a directory traversal vulnerability via the 'fileName' parameter

[Mitigation] Apply SAP Security Note 2234971 immediately and restrict external access to the AS Java management console

[Affected Scope] SAP NetWeaver AS JAVA version 7.4 utilizing the Universal Worklist (UWL) configuration.

[Impact] Unauthenticated remote attackers can obtain sensitive user information and system configuration details via crafted HTTP requests.

[Mitigation] Apply SAP Security Note 2256846 immediately and restrict external access to UWL-related endpoints.

[Affected Scope] UDDI (Universal Description, Discovery, and Integration) server component running on SAP NetWeaver J2EE Engine version 7.40.

[Impact] Unauthenticated remote attackers can execute arbitrary SQL commands via crafted requests, potentially leading to complete database compromise, data exfiltration, or remote code execution.

[Mitigation] Immediately apply SAP Security Note 2101079, disable the UDDI service if not required, and restrict network access.